195269[.]com

This domain is flagged as an elevated-risk fake login portal designed to harvest credentials. Analysis indicates the infrastructure was specifically engineered to mimic legitimate authentication pages, likely targeting users of financial or corporate services. The domain exhibits characteristics consistent with credential theft operations, including the use of default SSL certificates and hosting in a region commonly associated with phishing campaigns. Infrastructure analysis reveals the domain 195269.com was registered on June 01, 2021, through GoDaddy.com, LLC. It resolved to the IP address 103.143.28.212, located in Hong Kong under autonomous system AS135581 (ONL-HK). At the time of detection, 21 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appeared on one security blocklist and was subsequently blocked by a specialized anti-phishing system. The SSL certificate was issued to 'Default Company Ltd,' a common indicator of low-effort phishing infrastructure. Despite its current offline status, historical records confirm its prior use in active phishing operations. Mitigation steps for organizations and end-users include immediate blocking of the domain and its associated IP address (103.143.28.212) at the network perimeter. Security teams should review logs for connections to this domain or IP, particularly from endpoints that may have interacted with credential submission forms. Users who accessed the domain should reset passwords for any accounts entered on the site and enable multi-factor authentication where available. Domain registrars and hosting providers should be notified of the malicious infrastructure to prevent reactivation under similar names. Proactive monitoring for domains registered through the same registrar or resolving to the same IP range is recommended to detect potential follow-up campaigns.